PT-2015-2461 · Owncloud · Owncloud Server
Publicado
2015-10-18
·
Atualizado
2015-10-22
·
CVE-2015-5954
CVSS v2.0
4.0
Média
| Vetor | AV:N/AC:L/Au:S/C:P/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
ownCloud Server versions prior to 6.0.9
ownCloud Server versions 7.0.x prior to 7.0.7
ownCloud Server versions 8.0.x prior to 8.0.5
Description
The virtual filesystem in ownCloud Server does not consider that NULL is a valid getPath return value, which allows remote authenticated users to bypass intended access restrictions and gain access to users' files via a sharing link to a file with a deleted parent folder. This issue is related to a lack of checking of returned data in the virtual filesystem, allowing a remote attacker to circumvent existing access restrictions.
Recommendations
For ownCloud Server versions prior to 6.0.9, update to version 6.0.9 or later.
For ownCloud Server versions 7.0.x prior to 7.0.7, update to version 7.0.7 or later.
For ownCloud Server versions 8.0.x prior to 8.0.5, update to version 8.0.5 or later.
Correção
Unchecked Return Value
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Owncloud Server